pf: relax sctp v_tag verification

pf was too strict when validating SCTP tags. When a server receives a
retransmitted INIT it will reply with a random initiate tag every time.
However, pf saves the first initiate tag and expects every subsequent INIT_ACK
retransmission to have the same tag. This is not the case, leading to endless
INIT/INIT_ACK cycles.

Allow the tag to be updated as long as we've not gone past COOKIE_WAIT.

Add a test case to verify this.

MFC after: 2 weeks
See also: https://redmine.pfsense.org/issues/16516
Sponsored by: Rubicon Communications, LLC ("Netgate")

(cherry picked from commit bc3b72ff48953551e0e8bd6e5a2c718ecd973285)